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INFORMATION DISCLOSURE STATEMENT 



Applicant respectfully requests that the Examiner give full consideration to the items 
listed in the Information Disclosure Statement submitted February 1, 1999. The Examiner 
contends that "the non-patent materials on those pages 2-10 are only directed toward intrusion 
detection systems per se and not direct [sic] towards the pending filed claims, that is a manner, 
a system for dynamically distributing updates of a program (version) in a network per se^ Office 
Action, p. 2. Yet, one embodiment of the present invention is "[a]n intrusion detection system" 
as claimed by Claim 22. Therefore, any disclosure relating to intrusion detection systems per se 
is proper and should be considered. Furthermore, several non-patent documents in the IDS relate 
to distributed networking and distributed recognition and, therefore, are also proper. See MPEP 



Applicant thanks the Examiner for providing references in response to Applicant's 
seasonal traversal of Examiner's Official Notice as described in MPEP § 2144.03. 

REMARKS 

This Apphcation has been carefully reviewed in light of the Advisory Action mailed 
October 16, 2001. Claims 9-13, 22-24, and 27 remain pending at the time of the Advisory 
Action. Applicant respectfully requests reconsideration and favorable action in this case. 

Claims 9-13, 22-24, and 27 stand rejected under U.S.C. § 103 in view of U.S. Patent No. 
5,008,814 issued to Mathur {"Mathuf) and U.S. Patent No. 5,754,785 issued to Lysik, et al 
Q'Lysik"), Applicant respectfully traverses this rejection for at least the following reasons. 

Amended Claim 9 recites, in part, "automatically installing a downloaded update to 
generate a second version of the program" and "automatically determining whether the second 
version of the program is operating correctly." Furthermore, amended Claim 9 recites "in 
response to incorrect operation of the second version, automatically restoring the first version of 
the program for operation at the network site." 



§ 609. 



OFFICIAL NOTICE 



The Examiner does not rely upon Lysik, nor does Lysik teach or suggest these elements 
of amended Claim 9. Mathur does not teach or suggest these elements of amended Claim 9. The 
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Examiner asserts that Mathur teaches "restoring the original software (first version), in response 
to incorrect operation of the updated software (second version)". Office Action, p. 3. However, 
Mathur includes an operator element. For example, Mathur states that after the software is 
updated, "[t]he trial use is initiated when the operator issues a 'cutover' command to a master 
task." Mathur, c. 12, 11. 10-12 (emphasis added). Mathur fijrther states "a cutback process which 
restores a node to an 'old' software version when a trial use fails. The cutback process is 
initiated by an operator command, . ." Mathur, c. 12, 11. 36-39 (emphasis added). Mathur also 
states "[i]f the operator decides to abort the softload process, the master task at the operator node 
No will issue an abort request. . ." Mathur, c. 9, 1. 67 - c. 10, 1. 1 (emphasis added). In contrast, 
amended Claim 9 recites "in response to incorrect operation of the second version, automatically 
restoring the first version of the program for operation at the network site" (emphasis added). 
Therefore, neither Mathur nor Lysik, alone or in combination, teach or suggest every element of 
amended Claim 9. 

Additionally, Mathur would teach awa y from "automatically installing a downloaded 
update to generate a second version of the program", as recited by amended Claim 9, because 
Mathur is directed to an operator initiated installation. See Mathur, c. 12, 11. 10-12. One skilled 
in the art would not look to a reference that teaches an operator-dependent process to determine 
how to automate installing a downloaded update. 

Therefore, Applicant respectfiiUy requests the Examiner to reconsider and withdraw the 
rejection for Claim 9. 

Amended Claim 10 recites "automatically distributing the dovmloaded update to a 
disparate network site operating the first version of the program." Amended Claim 10 further 
recites "automatically installing the downloaded update to generate the second version of the 
program at the disparate network site." 

The Examiner does not rely upon Lysik, nor does Lysik teach or suggest these elements 
of amended Claim 10. Mathur does not teach or suggest these elements of amended Claim 10. 
Instead, Mathur teaches away from amended Claim 10. Mathur states that "[a]dvantageously, 
the distribution is initiated by a 'distribution command' which is entered by an operator at an 
input/output device in one of the nodes. . ." Mathur, c. 4, 1. 66 - c. 5, 1. 3 (emphasis added). Not 
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only is a distribution command required, it is a command that must be entered by an operator. 
To this end, Mathur states that "the communication of a new system software version from a 
source node Ns to a destination node Nd . . . is initiated by an operator command." Mathur, c. 1 1, 
11. 16-19. Mathur further states the updated software is installed at disparate nodes when "[t]he 
update process is initiated by an operator command. . Mathur, c. 12, 11. 66-67. Nowhere does 
Mathur disclose ''automatically distributing the downloaded update to a disparate network site 
operating the first version of the program" as recited by amended Claim 1 0 (emphasis added). 
Thus, neither Mathur nor Lysik, alone or in combination, teach or suggest every element of 
amended Claim 10. 



Therefore, Applicant respectfixUy requests the Examiner to reconsider and withdraw the 
rejection for Claim 10. Furthermore, amended independent Claims 11, 12, and 22 are patentable 
for at least the reasons discussed above in association with Claim 10. Thus, Applicant 
respectfully requests allowance of independent Claims 11, 12, and 22. 

Dependent Claim 26 depends from dependent Claim 13, which depends from independent 
Claim 12. Also, dependent Claims 23 and 24 depend from independent Claim 22. Claims 10, 
Claims 11, 12, and 22 are shown above to be allowable over the cited references. Thus, 
dependent Claims 13, 23, 24, and 26 are allowable over the cited references as depending from 
an allowable base claim and including further distinctions over the cited references. For at least 
these reasons, Applicant respectfully requests allowance of dependent Claims 13, 23, 24, and 26. 
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CONCLUSION 



Applicant has made an earnest attempt to place this case in condition for allowance. For 
the foregoing reasons and for other reasons clearly apparent, Applicant respectfully requests 
reconsideration and full allowance of all pending claims. 



In order to expedite the prosecution of this case, the undersigned attorney for Applicant 
invites the Examiner to call at the telephone nimiber listed below if there is a need to clarify any 
outstanding issues. 



The fee of $740.00 to satisfy the Request for Continued Examination fee of 37 C.F.R. § 
1 . 1 7(e) is enclosed. The Commissioner is hereby authorized to charge any additional fees or 
credit any overpayment to Deposit Accoimt 02-0384 of Baker Botts L.L.P. 



Respectfully submitted, 
BAKER BOTTS L.L.P. 
Attorneys for Applicant 




Matthew B. Talpis 
Reg. No. 45,152 

Date: 

Please Send Correspondence to : 

Matthew B. Talpis, Esq. 

Baker Botts L.L.P. 

2001 Ross Avenue, Suite 600 

Dallas, Texas 75201-2980 

Tel: (214) 953-6984 

Fax: (214)661-4984 

matt . t alpis@bakerbotts .com 
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APPENDIX "A" 
MARKED-UP VERSION OF THE CLAIMS 



(Previously cancelled without prejudice or disclaimer) 
(Previously cancelled vcithout prejudice or disclaimer) 
(Previously cancelled vfithout prejudice or disclaimer) 



(Previously cancelled without prejudice or disclaimer) 
(Previously cancelled without prejudice or disclaimer) 
(Previously cancelled without prejudice or disclaimer) 
(Previously cancelled without prejudice or disclaimer) 
(Previously cancelled without prejudice or disclaimer) 



WHAT IS CLAIMED IS: 
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9. 



(Amended) A method for updating a first version of a program operating at 



a network site, comprising: 

in response to an automated event, automatically downloading from a remote site any 
update for the program; 

automatically installing a downloaded update to generate a second version of the 
program; 

after installation of the downloaded update, automatically determining whether the 
second version of the program is operating correctly; 

in response to correct operation of the second version, operating the second version of 
the program in place of the first version at the network site; and 

in response to incorrect operation of the second version, automatically restoring the 
first version of the program for operation at the network site. 
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10. (Amended) A method for updating a first version of a program operating at 
a network site, comprising: 

in response to an automated event, automatically downloading from a remote site any 
update for the program; 

installing a downloaded update to generate a second version of the program; and 

operating the second version of the program in place of the first version at the network 

site; 

automatically distributing the downloaded update to a disparate network site 
operating the first version of the program; 

automatically installing the downloaded update to generate the second version of the 
program at the disparate network site; and 

operating the second version of the program in place of the first version at the 
disparate network site. 
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1 1 . (Amended) A method for updating a first version of a program operating at 
a network site, comprising: 

in response to an automated event, automatically downloading from a remote site any 
update for the program; 

installing a dovmloaded update to generate a second version of the program; 

after installation of the downloaded update, automatically determining whether the 
second version of the program is operating correctly at the network site; 

in response to incorrect operation of the second version, automatically restoring the 
first version of the program for operation at the network site; and 

in response to correct operation of the second version at the network site: 



automatically distributing the downloaded update to a disparate network site 
operating the first version of the program; 

automatically installing the downloaded update to generate the second 
version of the program at the disparate network site; and 

operating the second version of the program in place of the first version at the 
disparate network site. 
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12. (Amended) A method for updating a first version of a program operating at 
a network site, comprising: 

in response to an automated event, automatically downloading from a remote site any 
update for the program; 

automatically installing a downloaded update to generate a second version of the 
program; and 

operating the second version of the program in place of the first version at the network 

site; 

broadcasting over a network an update message; 

receiving in response to the update message a request for the downloaded update fi-om 
each of a plurality of disparate network sites operating the first version of the program; 

automatically distributing the dovmloaded update to the disparate network sites 
requesting the downloaded update; 

automatically installing the downloaded update to generate the second version of the 
program at each of the disparate network sites; and 

operating the second version of the program in place of the first version at each of the 
disparate network sites. 

13. The method of Claim 12, ftirther comprising: 
receiving a recovery event at one of the network sites; 

automatically restoring the first version of the program at the network site at which 

the recovery event was received; 

broadcasting a recovery message from the network site over the network; and 
automatically restoring the first version of the program at each of the remaining 

network sites operating the second version of the program. 

14. (Previously cancelled without prejudice or disclaimer) 

15. (Previously cancelled without prejudice or disclaimer) 

16. (Previously cancelled without prejudice or disclaimer) 



1 7. (Previously cancelled without prejudice or disclaimer) 

DALO 1:637957.1 



- ATTORNEY DOCKET ] 
062891.0240(108 1015) 




^TENT APPLICATION 
09/241,823 



18. (Previously cancelled without prejudice or disclaimer) 

19. (Previously cancelled without prejudice or disclaimer) 

20. (Previously cancelled without prejudice or disclaimer) 

21. (Previously cancelled without prejudice or disclaimer) 

22. (Amended) An intrusion detection system, comprising: 

a private network including a plurality of sites connected to a public network, each site 
including an intrusion detection sensor operating with a first set of intrusion detection signatures; 
and 

each of the intrusion detection sensors operable to automatically download fi"om a remote 
site any update for the intrusion detection signatures in response to a specified event, to 
automatically install a downloaded update to generate a second set of intrusion detection 
signatures, to operate with the second set of intrusion detection signatures, and to automatically 
distribute the downloaded update to the remaining intrusion detection sensors for installation. 

23. The system of Claim 22, wherein the specified event is an automated event. 

24. The system of Claim 23, wherein the automated event is a timed event. 

25. (Previously cancelled without prejudice or disclaimer) 

26. The method of Claim 13 wherein the recovery event occurs in response to 
incorrect operation of the intrusion detection program. 
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